Industry · Maritime transport
NIS2 compliance for shipping and ferry companies
Maritime transport sits in NIS2 Annex I, high criticality. For shipping and ferry companies that means documented risk management, a secured supply chain, and incident readiness, across ship and shore.
Why are shipping companies covered?
Maritime transport is a high-criticality sector in NIS2 (Annex I). Shipping and ferry companies above the threshold, roughly 50 employees or over €10M, will typically count as essential or important entities, with requirements for risk management, incident reporting, and board accountability. In addition, more and more charter and line customers impose compliance requirements by contract.
Industry-specific risks
Ship–shore communication
VSAT, remote control and synchronisation between vessels and the shore organisation extend the attack surface far beyond the office network.
Navigation and bridge systems
ECDIS, AIS and integrated bridge systems are OT rarely built for a modern threat landscape.
Overlap with IMO requirements
IMO 2021 and the company ISM management system overlap NIS2 on cyber risk, but rarely cover it fully. The gap must be documented.
Fleet and operations management
Planning, maintenance and bunkering systems connect many suppliers, each with their own access.
What Havvakt delivers
- Mapping of IT and OT systems across vessels and the shore organisation.
- Risk assessment based on NSM Basic Principles, with a gap analysis against IMO/ISM.
- Management system, action plan and supplier register as audit-ready documentation.
- Incident readiness with templates for 24-hour notification.
This is what the requirements look like for your industry. Let’s talk.
Questions from shipping companies
We already follow IMO 2021, is that enough?
IMO 2021 and ISM cover cyber risk in safety management, but not the full breadth of NIS2 (supply chain, incident reporting to the authority, board accountability). We document the overlap and close the gap so you don’t do the work twice.
Do the systems on board need physical mapping?
Mapping combines a remote review with targeted work on key vessels. We don’t rip anything out, we document what exists and prioritize measures by operational impact.
Does this also apply to smaller ferry companies?
The threshold is roughly 50 employees or €10M. If you are below it, you may still be covered via customers or public tenders imposing compliance requirements. We clarify it in the first call.